85543e6602
Avoids tying CI to a personal/bot Gitea account: the same DEPLOY_SSH_KEY secret used for the webserver rsync step is reused as a read-only Gitea deploy key on hmk/pelican-latex. The submodule's tracked HTTPS URL is overridden to SSH just for this checkout so it authenticates with that key instead of needing a token with access to both repos.